Class Action Lawsuit Filed Against Pharmacy Due to Data Breach

A class action lawsuit has been filed in Federal Court against Injured Workers Pharmacy (IWP), a Massachusetts-based pharmacy that serves employees who have been injured at work and receive workers’ compensation benefits.

The lawsuit is based on a breach of personal information for over 75,000 patients. According to the claims, on May 11, 2021, IWP discovered several employee email accounts had been accessed by an unauthorized individual, and those email accounts contained sensitive information, such as names, addresses, and social security numbers.

An investigation showed unauthorized access to information in the accounts had been taking place since January 2021, and 4 months passed before the breach was detected and the accounts were secure. Affected patients, however, were not notified about the breach until February 2022—9 months after the breach was detected. At that point, affected patients were offered complimentary credit monitoring services for 2 years.

The lawsuit alleges that the pharmacy failed to implement appropriate data security safeguards to ensure the privacy of its patients, follow industry security best practices, and provide security awareness training to its employees. The plaintiffs claim they face an ongoing risk of identity theft and fraud due to exposure of their personal protected information, and they have had to spend time and money protecting themselves.

The lawsuit alleges negligence, negligence per se, breach of implied contract and fiduciary duty, invasion of privacy, and unjust enrichment. The lawsuit seeks class action status, a jury trial, damages, reimbursement of expenses, and legal costs.